Require Pillow 12.3.0 or newer at install time

The dependency was declared unbounded, so the version an installer resolved
was whatever PyPI served at the time; the 12.3.0 floor was only enforced by
uv.lock, which constrains the uv environment rather than installs of the
published package.

12.3.0 is the first release clear of the known Pillow advisories, and it
ships wheels for cp310-cp315, so the floor excludes no interpreter covered
by requires-python = ">=3.10".

dev.toml is left alone: je_web_runner_dev does not declare Pillow at all,
since the imaging paths import PIL lazily.

Author: JE-Chen

dev_requirements.txt

@@ -5,7 +5,7 @@ je_web_runner_dev
 sphinx-rtd-theme
 Pyside6
 defusedxml
-Pillow
+Pillow>=12.3.0
 faker
 sqlalchemy
 pytest

pyproject.toml

@@ -24,7 +24,9 @@ dependencies = [
     'python-dotenv',
     "webdriver-manager",
     "defusedxml",
-    "Pillow",
+    # Floor set to the first release without the known Pillow advisories;
+    # wheels cover cp310-cp315, so it excludes no supported interpreter.
+    "Pillow>=12.3.0",
 ]
 classifiers = [
     "Development Status :: 2 - Pre-Alpha",

requirements.txt

@@ -1,5 +1,5 @@
 je_web_runner
 defusedxml
-Pillow
+Pillow>=12.3.0
 faker
 sqlalchemy